Monitor the change of a specific file

1

Hello

Is there a possibility to monitor for the change / modification of a specific file? So that we’d get an alert of that file has change?

Thanks

2

You could write a script and cache the hash of the files your monitoring in a asset custom field or a file on disk, but thats about the only option I can think of.

3

That or on the same lines, script to look at the date modified of the file and alert when it changes. You wouldn’t even need a custom field at that rate. If it doesn’t match what you expect, or if it changed in the last 24 hours or whatever you decide, have it immediately throw an alert.

4

Yeah, it depends how your worried about a file changing. It is possible to write a program that can save a file w/o changing the last modified date, though this would typically be malicious behavior. If your only worried about legitimate changes than monitoring the last change date is fine. I’d still want it stored somewhere in Syncro or on the endpoint as I have no interest in writing one script per asset and the likelihood of a file having different modified dates across multiple assets is high enough I wouldn’t want it hard coded.

I guess the one way this could work w/o storing the data somewhere would be to say run the script daily and check if the file was modified in the last 48 hours. Due to any number of things that might prevent a script from running this could still allow changes through but does resolve the issue of can you trust where you cached the expected values.

5

You can do this in a two-part system.

  1. Hook the windows file change event and write a log for files of interest.
  2. Periodically look at the log with a Syncro script.